REMARKS 

Reconsideration and allowance of the above-referenced application are respectfully 
requested. Claims 2, 8-9, 11, 13, 20, 26-27, 29, and 31 are amended, and claims 1-39 are 
pending in the application. 

Applicant appreciates the personal interview between the undersigned and Examiners 
Thompson and Klinger on April 14, 2005. During the interview, the features of the claimed 
invention and their distinctions relative to the applied prior art were discussed. The Examiners 
agreed to reconsider the outstanding rejections in view of the interview and the comments 
submitted herein. 

Rejections under 35 USC §112. Para. 1 

Claims 2, 8-9, 11, 13, 20, 26-27, 29, and 31 have been amended to ensure compliance 
with 35 USC §112, first paragraph. In particular, these claims as amended describe promiscuous 
detection as passing the detected IP frames independent of any specified IP destination address 
(see, e.g., page 4, line 24 to page 5, line 2). 

Regarding the rejection of claim 18, see page 5, lines 18-21, which describes that each 
application 26 is configured for generating a corresponding response IP frame for a detected IP 
frame based on the corresponding identified application request, independent of the IP source 
address within the detected IP frame (note that claim 18 specifies a plurality of the executable 
emulation applications, and not the promiscuous detection of the IP frames as described in the 
rejection). 

Hence, the §112, first paragraph rejection should be withdrawn. 
Rejections under §103 

Claims 1-39 stand rejected under 35 USC §103 in view of U.S. Patent No. 5,996,016 to 
Thalheimer et al in view of Mogul. These rejections are respectfully traversed. 

Each of the independent claims 1, 12, 19 and 30 specify emulation in a protocol emulator, 
where IP frames are promiscuously detected on a network interface. An executable emulation 
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application within the protocol emulator generates, for each corresponding detected IP frame, a 
response IP frame. Each response IP frame is output by a raw socket onto the network interface. 

As described in the specification (e.g., page 2, lines 17-23, page 3, lines 1-3), the 
promiscuous detection of IP frames on the network interface eliminates the necessity for 
conventional IP filtering of received IP frames that normally is performed by a UNIX kernel. 
Moreover, the generation of a response IP frame for each corresponding detected IP frame by the 
executable emulation application results in the executable emulation application receiving each 
detected IP frame in its entirety in order to generate the detected IP frame; hence, the need for 
stripping of any headers (e.g., IP header, TCP header, UDP header etc.) by a UNIX kernel is 
eliminated. Finally, the outputting of each response IP frame by the raw socket onto the network 
interface enables the kernel to be bypassed because the IP and TCP/UDP headers already have 
been completed based on the emulation application having generated the entire response IP 
frame , further reducing the reliance on operating system resources such as the UNIX kernel. 

Hence, the claimed invention eliminates the necessity for conventional kernel operations 
(e.g., IP filtering of packets, stripping IP header and TCP/UDP headers, and rebuilding the IP and 
TCP/UDP headers for a response frame), based on providing promiscuous detection of IP frames, 
generating a response IP framed by the executable emulation application for each correspondent 
detected IP frame, and outputting each response IP frame by a raw socket onto the network 
interface. Consequently, the claimed invention is able to emulate an unlimited number of IP 
addresses, since a UNIX descriptor is no longer needed for each and every IP address emulated 
by the protocol emulator. 

These and other features are neither disclosed nor suggested in the applied prior art. 

As described below, the §103 rejection of claims 1-39 in view of Thalheimer and Mogul 
is improper because the hypothetical combination: (1) is legally without foundation; (2) does not 
disclose or suggest generating a response IP frame for each promiscuously detected IP frame ; and 
(3) does not disclose or suggest the problems and features addressed by inventor. 
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As admitted in the Official Action, Thalheimer does not disclose or suggest: (1) how 
incoming frames are detected; (2) how response frames are sent ; (3) promiscuously detecting IP 
frames; and (4) outputting each response IP frame by a raw socket . 

Rather, Thalheimer relies on bindings between an IP address by intercepting a bind call , 
and using an alias IP address to complete the bind call . For example, col. 2, lines 5-7 specifies 
that "it is an object of the present invention to allow any TCP/IP application to bind to any IP 
address." Col. 2, lines 17-20 describe that a bind call is intercepted and reinitated using an 
alternate address, known as "address aliasing". 

As described in the subject application, use of alias IP addresses has required binding 
each of the logical IP addresses to a socket, implemented based on the UNIX kernel creating a 
file descriptor for each corresponding socket. Hence, Thalheimer is limited in the number of 
alias IP addresses that can be used before depleting kernel resources. 

Mogul describes passive monitoring of network traffic using promiscuous mode support, 
provides numerous examples of passive monitoring programs. Moreover, Mogul describes on 
page 255 (col. 2, second bullet paragraph) a packet filter that performs packet truncation to 
limit data supplied to monitoring applications : Mogul distinguishes monitoring from protocol 
implementation! 

More fundamentally, there is no description whatsoever in Mogul of a raw socket, let 
alone using a raw socket for outputting each response IP frame, that has been generated by the 
executable emulation application, onto the network interface. 

Hence, Mogul the solely directed to the monitoring of packets, and provides no disclosure 
whatsoever of being able to generate response packets for each IP frame detected using 
promiscuous detection. 

There is no evidence of any motivation to modify Thalheimer to include teachings of 
Mogul: Thalheimer is concerned with simulating a TCP/IP network (see Fig. 4), and Mogul is 
concerned with passive monitoring programs , and not with generating response frames. Mogul 
also emphasizes that network monitoring is "unlike protocol implementation" because 
applications "usually are concerned only with the first few bytes of each packet" as opposed to 
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the entire packet contents, enabling packets exceeding a truncation length to be truncated before 
delivery to the monitoring application. Hence, Mogul teaches away from using promiscuous 
mode detection of IP frames for any use other than passive monitoring. 

Moreover, the supposed motivation alleged by the Examiner is misplaced, because the 
use of commercial off-the-shelf hardware already is described at column 3, lines 42-55 of 
Thalheimer et aL Hence, the Office Action fails to provide any evidence why one skilled in the 
art would be motivated to modify Thalheimer et al. to include promiscuous mode support as 
taught by Mogul. "Teachings of references can be combined only if there is some suggestion or 
incentive to do so." In re Fine . 5 USPQ2d 1596,1600 (Fed. Cir. 1988) (quoting ACS Hosp. Svs. 
v. Montefiore Hosp. . 221 USPQ 929, 933 (Fed. Cir. 1984)) (emphasis in original). 

In fact, the attempted combination would destroy fundamental purpose of Thalheimer, 
since Mogul is explicit that promiscuous mode support can overwhelm system resources. 
Thalheimer also relies on binding applications to IP addresses: as described above, the subject 
specification described how promiscuous mode support in a system requiring bindings between 
each alias IP address would use up kernel resources and render Thalheimer inoperable. Hence, 
since the proposed modification or combination would change the principle of operation of the 
prior art invention being modified, then the teachings of the references are not sufficient to render 
the claims prima facie obvious. MPEP § 2143.01, page 2100-132 (Rev. 2, May 2004) ( citing In 
re Ratti . 123 USPQ 349 (CCPA 1959). 

The supposed motivation for combining references is based solely on Applicant's 
specification: there is no evidence of any desirability to modify Thalheimer for promiscuous 
detection (which is explicitly contrary to purpose of using aliased addresses ), especially since 
Thalheimer already addresses need to allow simulation of TCP/IP networks without rewriting 
software. Further, one skilled in the art would be left with the problems with why unrelated 
traffic between two other nodes in the network 50 (as illustrated in Fig. 4) would even be needed 
by the processing system 20 of Thalheimer et al (see col. 5, lines 33-60). 

Even assuming one skilled in the art was motivated to combine the two references, the 
hypothetical combination, while inoperable, still would neither disclose nor suggest generating a 
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response IP frame by the executable emulation application for each corresponding promiscuously 
detected IP frame , and then outputting each response IP frame (generated by the executable 
emulation application) by the raw socket onto the network interface . 

Rather, the hypothetical combination simply would provide combined monitoring with 
aliasing which requires binding of aliased addressees. 

An evaluation of obviousness must be undertaken from the perspective of one of ordinary 
skill in the art addressing the same problems addressed by the applicant in arriving at the claimed 
invention. Bausch & Lomb, Inc. v. Barnes-Hind/Hvdrocurve , 23 USPQ 416, 420 (Fed. Cir. 
1986), cert, denied , 484 US 823 (1987). Thus, the claimed structures and methods cannot be 
divorced from the problems addressed by the inventor and the benefits resulting from the claimed 
invention. In re Newell , 13 USPQ2d 1248, 1250 (Fed. Cir. 1989). 

None of the applied references, singly or in combination, even begin to address the 
inventor's concern for providing scalable emulation of IP addresses that enables an unlimited 
number of IP addresses to be emulated. As described above, the claimed features enable the use 
of kernel resources to be minimized and independent of the IP addresses being emulated. 

For these and other reasons, the §103 rejection should be withdrawn. 

In view of the above, it is believed this application is and condition for allowance, and 
such a Notice is respectfully solicited. 

To the extent necessary, Applicant petitions for an extension of time under 37 C.F.R. 
1.136. Please charge any shortage in fees due in connection with the filing of this paper, 
including any missing or insufficient fees under 37 C.F.R. 1.17(a), to Deposit Account No. 
50-1 130, under Order No. 95-451, and please credit any excess fees to such deposit account. 




Leon R. Turkevich 
Registration No. 34,035 



Customer No. 23164 
Date: April 14, 2005 



Amendment filed April 14, 2005 
Appln. No. 09/725,930 
Page 14 



